#!/bin/sh /etc/rc.common
#
# Copyright (C) 2017 openwrt-ssr
# Copyright (C) 2017 yushi studio <ywb94@qq.com>
# Copyright (C) 2018 lean <coolsnowwolf@gmail.com>
#
# This is free software, licensed under the GNU General Public License v3.
# See /LICENSE for more information.
#

START=95
STOP=15

SERVICE_DAEMONIZE=1
NAME=shadowsocksr
EXTRA_COMMANDS=rules
CONFIG_FILE=/var/etc/${NAME}.json
CONFIG_UDP_FILE=/var/etc/${NAME}_u.json
CONFIG_SOCK5_FILE=/var/etc/${NAME}_s.json
CONFIG_NETFLIX_FILE=/var/etc/${NAME}_n.json
server_count=0
redir_tcp=0
redir_udp=0
tunnel_enable=0
local_enable=0
kcp_enable_flag=0
kcp_flag=0
pdnsd_enable_flag=0
switch_enable=0
switch_server=$1
MAXFD=32768
CRON_FILE=/etc/crontabs/root
threads=1

uci_get_by_name() {
	local ret=$(uci get $NAME.$1.$2 2>/dev/null)
	echo ${ret:=$3}
}

uci_get_by_type() {
	local ret=$(uci get $NAME.@$1[0].$2 2>/dev/null)
	echo ${ret:=$3}
}

uci_get_by_cfgid() {
	local ret=$(uci show $NAME.@$1[0].$2 | awk -F '.' '{print $2}' 2>/dev/null)
	echo ${ret:=$3}
}

check_host() {
	local host=$1
	if echo $host | grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >/dev/null; then
		hostip=$host
	elif [ "$host" != "${host#*:[0-9a-fA-F]}" ]; then
		hostip=$host
	else
		hostip=$(ping $host -W 1 -s 1 -c 1 | grep PING | cut -d'(' -f 2 | cut -d')' -f1)
		if echo $hostip | grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >/dev/null; then
			hostip=$hostip
		else
			hostip="127.0.0.1"
		fi
	fi
	echo -e $hostip
}

add_cron() {
	sed -i '/shadowsocksr/d' $CRON_FILE
	sed -i '/ssrplus.log/d' $CRON_FILE && echo '0 1 * * * echo "" > /tmp/ssrplus.log' >>$CRON_FILE
	[ $(uci_get_by_type server_subscribe auto_update 0) -eq 1 ] && echo "0 $(uci_get_by_type server_subscribe auto_update_time) * * * /usr/share/shadowsocksr/ssrplusupdate.sh >> /tmp/ssrplus.log 2>&1" >>$CRON_FILE

	crontab $CRON_FILE
}

del_cron() {
	sed -i '/shadowsocksr/d' $CRON_FILE
	sed -i '/ssrplus.log/d' $CRON_FILE
	/etc/init.d/cron restart
}

run_mode=$(uci_get_by_type global run_mode)

gen_config_file() {
	local host=$(uci_get_by_name $1 server)
	if echo $host | grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >/dev/null; then
		hostip=$host
	elif [ "$host" != "${host#*:[0-9a-fA-F]}" ]; then
		hostip=$host
	else
		hostip=$(ping $host -W 1 -s 1 -c 1 | grep PING | cut -d'(' -f 2 | cut -d')' -f1)
		if echo $hostip | grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >/dev/null; then
			hostip=$hostip
		else
			hostip=$(cat /etc/ssr_ip)
		fi
	fi
	[ "$2" == "0" -a "$kcp_flag" == "1" ] && hostip="127.0.0.1"
	if [ "$2" == "0" ]; then
		config_file=$CONFIG_FILE
	elif [ "$2" == "1" ]; then
		config_file=$CONFIG_UDP_FILE
	elif [ "$2" == "2" ]; then
		config_file=$CONFIG_NETFLIX_FILE
	else
		config_file=$CONFIG_SOCK5_FILE
	fi
	if [ $(uci_get_by_name $1 fast_open 0) == "1" ]; then
		fastopen="true"
	else
		fastopen="false"
	fi
	local stype=$(uci_get_by_name $1 type)
	if [ "$stype" == "ss" ]; then
		cat <<-EOF >$config_file
			{
			"server": "$hostip",
			"server_port": $(uci_get_by_name $1 server_port),
			"local_address": "0.0.0.0",
			"local_port": $3,
			"password": "$(uci_get_by_name $1 password)",
			"timeout": $(uci_get_by_name $1 timeout 60),
			"method": "$(uci_get_by_name $1 encrypt_method_ss)",
			"reuse_port": true,
			"fast_open": $fastopen
			}
		EOF
		local plugin=$(uci_get_by_name $1 plugin)
		if [ -n "$plugin" ]; then
			if [ "$plugin" == "simple-obfs" ]; then
				plugin="obfs-local"
			fi
			if [ -x "/usr/bin/$plugin" ]; then
				sed -i "s@$hostip\",@$hostip\",\n\"plugin\": \"$plugin\",\n\"plugin_opts\": \"$(uci_get_by_name $1 plugin_opts)\",@" $config_file
			else
				echo "$(date "+%Y-%m-%d %H:%M:%S") Warning!!! SIP003 plugin $plugin not found!!!" >>/tmp/ssrplus.log
			fi
		fi
	elif [ "$stype" == "ssr" ]; then
		cat <<-EOF >$config_file
			{
			"server": "$hostip",
			"server_port": $(uci_get_by_name $1 server_port),
			"local_address": "0.0.0.0",
			"local_port": $3,
			"password": "$(uci_get_by_name $1 password)",
			"timeout": $(uci_get_by_name $1 timeout 60),
			"method": "$(uci_get_by_name $1 encrypt_method)",
			"protocol": "$(uci_get_by_name $1 protocol)",
			"protocol_param": "$(uci_get_by_name $1 protocol_param)",
			"obfs": "$(uci_get_by_name $1 obfs)",
			"obfs_param": "$(uci_get_by_name $1 obfs_param)",
			"reuse_port": true,
			"fast_open": $fastopen
			}
		EOF
	elif [ "$stype" == "v2ray" ]; then
		lua /usr/share/shadowsocksr/genv2config.lua $GLOBAL_SERVER tcp $(uci_get_by_name $1 local_port) >/var/etc/v2-ssr-retcp.json
		sed -i 's/\\//g' /var/etc/v2-ssr-retcp.json
	elif [ "$stype" == "trojan" ]; then
		lua /usr/share/shadowsocksr/gentrojanconfig.lua $GLOBAL_SERVER nat $(uci_get_by_name $1 local_port) >/var/etc/trojan-ssr-retcp.json
		sed -i 's/\\//g' /var/etc/trojan-ssr-retcp.json
	fi
}

get_arg_out() {
	case "$(uci_get_by_type access_control router_proxy 1)" in
	1) echo "-o" ;;
	2) echo "-O" ;;
	esac
}

start_rules() {
	local server=$(uci_get_by_name $GLOBAL_SERVER server)
	#resolve name
	if echo $server | grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >/dev/null; then
		server=$server
	elif [ "$server" != "${server#*:[0-9a-fA-F]}" ]; then
		server=$server
	else
		server=$(ping $server -W 1 -s 1 -c 1 | grep PING | cut -d'(' -f 2 | cut -d')' -f1)
		if echo $server | grep -E "^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$" >/dev/null; then
			echo $server >/etc/ssr_ip
		else
			server=$(cat /etc/ssr_ip)
		fi
	fi
	kcp_server=$server
	local kcp_enable=$(uci_get_by_name $GLOBAL_SERVER kcp_enable 0)
	if [ $kcp_enable == "1" ]; then
		kcp_flag=1
	fi
	local local_port=$(uci_get_by_name $GLOBAL_SERVER local_port)
	local lan_ac_ips=$(uci_get_by_type access_control lan_ac_ips)
	local lan_ac_mode=$(uci_get_by_type access_control lan_ac_mode)
	local router_proxy=$(uci_get_by_type access_control router_proxy)
	if [ "$GLOBAL_SERVER" == "$UDP_RELAY_SERVER" -a "$kcp_flag" == "0" ]; then
		ARG_UDP="-u"
	elif [ -n "$UDP_RELAY_SERVER" ]; then
		ARG_UDP="-U"
		local udp_server=$(uci_get_by_name $UDP_RELAY_SERVER server)
		local udp_local_port=$(uci_get_by_name $UDP_RELAY_SERVER local_port)
	fi
	if [ -n "$lan_ac_ips" ]; then
		case "$lan_ac_mode" in
		w | W | b | B) local ac_ips="$lan_ac_mode$lan_ac_ips" ;;
		esac
	fi

	#deal gfw firewall rule
	local gfwmode=""
	if [ "$run_mode" == "gfw" ]; then
		gfwmode="-g"
	elif [ "$run_mode" == "router" ]; then
		gfwmode="-r"
	elif [ "$run_mode" == "oversea" ]; then
		gfwmode="-c"
	elif [ "$run_mode" == "all" ]; then
		gfwmode="-z"
	fi
	local dports=$(uci_get_by_type global dports 1)
	if [ $dports == "1" ]; then
		proxyport=" "
	else
		proxyport="-m multiport --dports 22,53,587,465,995,993,143,80,443"
	fi
	if [ "$NETFLIX_SERVER" != "nil" ]; then
		if [ "$NETFLIX_SERVER" != "$GLOBAL_SERVER" ]; then
			netflix="1"
		else
			netflix="2"
		fi
	else
		netflix="0"
	fi
	netflix_ip=$(check_host $(uci_get_by_name $NETFLIX_SERVER server 127.0.0.1))
	/usr/bin/ssr-rules \
	-s "$server" \
	-l "$local_port" \
	-S "$udp_server" \
	-L "$udp_local_port" \
	-a "$ac_ips" \
	-i "$(uci_get_by_type access_control wan_bp_list)" \
	-b "$(uci_get_by_type access_control wan_bp_ips)" \
	-w "$(uci_get_by_type access_control wan_fw_ips)" \
	-B "$(uci_get_by_type access_control lan_bp_ips)" \
	-p "$(uci_get_by_type access_control lan_fp_ips)" \
	-G "$(uci_get_by_type access_control lan_gm_ips)" \
	-D "$proxyport" \
	-F "$netflix" \
	-N "$netflix_ip" \
	-M "$(uci_get_by_type global netflix_proxy 0)" \
	$(get_arg_out) $gfwmode $ARG_UDP
	return $?
}

start_pdnsd() {
	local usr_dns="$1"
	local usr_port="$2"
	local tcp_dns_list="208.67.222.222, 208.67.220.220"
	[ -z "$usr_dns" ] && usr_dns="8.8.8.8"
	[ -z "$usr_port" ] && usr_port="53"
	[ -d /var/etc ] || mkdir -p /var/etc
	if [ ! -d /var/pdnsd ]; then
		mkdir -p /var/pdnsd
		echo -ne "pd13\000\000\000\000" >/var/pdnsd/pdnsd.cache
		chown -R nobody:nogroup /var/pdnsd
	fi
	cat <<-EOF >/var/etc/pdnsd.conf
		global{
		perm_cache=1024;
		cache_dir="/var/pdnsd";
		pid_file="/var/run/pdnsd.pid";
		run_as="nobody";
		server_ip=127.0.0.1;
		server_port=5335;
		status_ctl=on;
		query_method=tcp_only;
		min_ttl=1h;
		max_ttl=1w;
		timeout=10;
		neg_domain_pol=on;
		proc_limit=2;
		procq_limit=8;
		par_queries=1;
		}
		server{
		label="ssr-usrdns";
		ip=$usr_dns;
		port=$usr_port;
		timeout=6;
		uptest=none;
		interval=10m;
		purge_cache=off;
		}
	EOF
	/usr/sbin/pdnsd -c /var/etc/pdnsd.conf &
}

start_redir() {
	case "$(uci_get_by_name $GLOBAL_SERVER auth_enable)" in
	1 | on | true | yes | enabled) ARG_OTA="-A" ;;
	*) ARG_OTA="" ;;
	esac
	#deal kcp
	local kcp_enable=$(uci_get_by_name $GLOBAL_SERVER kcp_enable 0)
	if [ "$kcp_enable" == "1" ]; then
		[ ! -f "/usr/bin/kcptun-client" ] && return 1
		local kcp_str=$(/usr/bin/kcptun-client -v | grep kcptun | wc -l)
		[ "0" == "$kcp_str" ] && return 1
		local kcp_port=$(uci_get_by_name $GLOBAL_SERVER kcp_port)
		local server_port=$(uci_get_by_name $GLOBAL_SERVER server_port)
		local password=$(uci_get_by_name $GLOBAL_SERVER kcp_password)
		local kcp_param=$(uci_get_by_name $GLOBAL_SERVER kcp_param)
		[ "$password" != "" ] && password="--key "$password
		service_start /usr/bin/kcptun-client \
		-r $kcp_server:$kcp_port \
		-l :$server_port $password $kcp_param
		kcp_enable_flag=1
	fi

	gen_config_file $GLOBAL_SERVER 0 $(uci_get_by_name $GLOBAL_SERVER local_port 1234)
	local stype=$(uci_get_by_name $GLOBAL_SERVER type)
	if [ "$stype" == "ss" ]; then
		sscmd="/usr/bin/ss-redir"
	elif [ "$stype" == "ssr" ]; then
		sscmd="/usr/bin/ssr-redir"
	elif [ "$stype" == "v2ray" ]; then
		sscmd="/usr/bin/v2ray/v2ray"
		[ ! -f "$sscmd" ] && sscmd="/usr/bin/v2ray"
	elif [ "$stype" == "trojan" ]; then
		sscmd="/usr/sbin/trojan"
	elif [ "$stype" == "socks5" ]; then
		sscmd="/usr/sbin/redsocks2"
	elif [ "$stype" == "tun" ]; then
		sscmd="/usr/sbin/redsocks2"
	fi

	local ntype=$(uci_get_by_name $NETFLIX_SERVER type)
	if [ "$ntype" == "ss" ]; then
		ncmd="/usr/bin/ss-redir"
		sssock="/usr/bin/ss-local"
	elif [ "$ntype" == "ssr" ]; then
		ncmd="/usr/bin/ssr-redir"
		sssock="/usr/bin/ssr-local"
	elif [ "$ntype" == "v2ray" ]; then
		ncmd="/usr/bin/v2ray/v2ray"
		[ ! -f "$ncmd" ] && ncmd="/usr/bin/v2ray"
	elif [ "$ntype" == "trojan" ]; then
		ncmd="/usr/sbin/trojan"
	elif [ "$ntype" == "socks5" ]; then
		ncmd="/usr/sbin/redsocks2"
	elif [ "$ntype" == "tun" ]; then
		ncmd="/usr/sbin/redsocks2"
	fi

	local utype=$(uci_get_by_name $UDP_RELAY_SERVER type)
	if [ "$utype" == "ss" ]; then
		ucmd="/usr/bin/ss-redir"
	elif [ "$utype" == "ssr" ]; then
		ucmd="/usr/bin/ssr-redir"
	elif [ "$utype" == "v2ray" ]; then
		ucmd="/usr/bin/v2ray/v2ray"
		[ ! -f "$ucmd" ] && ucmd="/usr/bin/v2ray"
	elif [ "$utype" == "trojan" ]; then
		ucmd="/usr/sbin/trojan"
	elif [ "$stype" == "socks5" ]; then
		ucmd="/usr/sbin/redsocks2"
	elif [ "$stype" == "tun" ]; then
		ucmd="/usr/sbin/redsocks2"
	fi
	if [ "$(uci_get_by_type global threads 0)" == "0" ]; then
		threads=$(cat /proc/cpuinfo | grep 'processor' | wc -l)
	else
		threads=$(uci_get_by_type global threads)
	fi

	if [ "$stype" == "ss" -o "$stype" == "ssr" ]; then
		local last_config_file=$CONFIG_FILE
		local pid_file="/var/run/ssr-retcp.pid"
		for i in $(seq 1 $threads); do
			$sscmd -c $CONFIG_FILE $ARG_OTA -f /var/run/ssr-retcp_$i.pid >/dev/null 2>&1
		done
		echo "$(date "+%Y-%m-%d %H:%M:%S") Shadowsocks/ShadowsocksR $threads Threads Started!" >>/tmp/ssrplus.log
	elif [ "$stype" == "v2ray" ]; then
		$sscmd -config /var/etc/v2-ssr-retcp.json >/dev/null 2>&1 &
		echo "$(date "+%Y-%m-%d %H:%M:%S") $($sscmd -version | head -1) Started!" >>/tmp/ssrplus.log
	elif [ "$stype" == "trojan" ]; then
		for i in $(seq 1 $threads); do
			$sscmd --config /var/etc/trojan-ssr-retcp.json >/dev/null 2>&1 &
		done
		echo "$(date "+%Y-%m-%d %H:%M:%S") $($sscmd --version 2>&1 | head -1) , $threads Threads Started!" >>/tmp/ssrplus.log
	elif [ "$stype" == "socks5" ]; then
		/usr/share/shadowsocksr/genred2config.sh "/var/etc/redsocks-ssr-retcp.conf" socks5 tcp $(uci_get_by_name $GLOBAL_SERVER local_port) \
		$(check_host $(uci_get_by_name $GLOBAL_SERVER server)) $(uci_get_by_name $GLOBAL_SERVER server_port) \
		$(uci_get_by_name $GLOBAL_SERVER auth_enable 0) $(uci_get_by_name $GLOBAL_SERVER username) $(uci_get_by_name $GLOBAL_SERVER password)
		for i in $(seq 1 $threads); do
			$sscmd -c /var/etc/redsocks-ssr-retcp.conf >/dev/null 2>&1
		done
		echo "$(date "+%Y-%m-%d %H:%M:%S") Socks5 REDIRECT/TPROXY $threads Threads Started!" >>/tmp/ssrplus.log
	elif [ "$stype" == "tun" ]; then
		/usr/share/shadowsocksr/genred2config.sh "/var/etc/redsocks-ssr-retcp.conf" vpn $(uci_get_by_name $GLOBAL_SERVER iface "br-lan") $(uci_get_by_name $GLOBAL_SERVER local_port)
		for i in $(seq 1 $threads); do
			$sscmd -c /var/etc/redsocks-ssr-retcp.conf >/dev/null 2>&1
		done
		echo "$(date "+%Y-%m-%d %H:%M:%S") Network Tunnel REDIRECT $threads Threads Started!" >>/tmp/ssrplus.log
	fi

	if [ "$NETFLIX_SERVER" != "nil" ] && [ "$NETFLIX_SERVER" != "$GLOBAL_SERVER" ]; then
		if [ "$ntype" == "ss" -o "$ntype" == "ssr" ]; then
			gen_config_file $NETFLIX_SERVER 2 4321
			gen_config_file $NETFLIX_SERVER 3 1088
			$sssock -c /var/etc/shadowsocksr_s.json $ARG_OTA -f /var/run/ssr-socksdns.pid >/dev/null 2>&1
			dns2socks 127.0.0.1:1088 8.8.8.8:53 127.0.0.1:5555 -q >/dev/null 2>&1 &
			$ncmd -c /var/etc/shadowsocksr_n.json $ARG_OTA -f /var/run/ssr-netflix.pid >/dev/null 2>&1
		elif [ "$ntype" == "v2ray" ]; then
			lua /usr/share/shadowsocksr/genv2config.lua $NETFLIX_SERVER tcp 4321 1088 >/var/etc/v2-ssr-netflix.json
			$ncmd -config /var/etc/v2-ssr-netflix.json >/dev/null 2>&1 &
			dns2socks 127.0.0.1:1088 8.8.8.8:53 127.0.0.1:5555 -q >/dev/null 2>&1 &
		elif [ "$ntype" == "trojan" ]; then
			lua /usr/share/shadowsocksr/gentrojanconfig.lua $NETFLIX_SERVER nat 4321 >/var/etc/trojan-ssr-netflix.json
			sed -i 's/\\//g' /var/etc/trojan-ssr-netflix.json
			$ncmd --config /var/etc/trojan-ssr-netflix.json >/dev/null 2>&1 &
			lua /usr/share/shadowsocksr/gentrojanconfig.lua $NETFLIX_SERVER client 1088 >/var/etc/trojan-ssr-socksdns.json
			sed -i 's/\\//g' /var/etc/trojan-ssr-socksdns.json
			$ncmd --config /var/etc/trojan-ssr-socksdns.json >/dev/null 2>&1 &
			dns2socks 127.0.0.1:1088 8.8.8.8:53 127.0.0.1:5555 -q >/dev/null 2>&1 &
		elif [ "$ntype" == "socks5" ]; then
			/usr/share/shadowsocksr/genred2config.sh "/var/etc/redsocks-ssr-netflix.conf" socks5 tcp 4321 \
			$(check_host $(uci_get_by_name $NETFLIX_SERVER server)) $(uci_get_by_name $NETFLIX_SERVER server_port) \
			$(uci_get_by_name $NETFLIX_SERVER auth_enable 0) $(uci_get_by_name $NETFLIX_SERVER username) $(uci_get_by_name $NETFLIX_SERVER password)
			$ncmd -c /var/etc/redsocks-ssr-netflix.conf >/dev/null 2>&1
			microsocks -i 127.0.0.1 -p 1088 ssr-socksdns >/dev/null 2>&1 &
			dns2socks 127.0.0.1:1088 8.8.8.8:53 127.0.0.1:5555 -q >/dev/null 2>&1 &
		elif [ "$ntype" == "tun" ]; then
			/usr/share/shadowsocksr/genred2config.sh "/var/etc/redsocks-ssr-netflix.conf" vpn $(uci_get_by_name $NETFLIX_SERVER iface "br-lan") 4321
			$ncmd -c /var/etc/redsocks-ssr-netflix.conf >/dev/null 2>&1
			microsocks -i 127.0.0.1 -p 1088 ssr-socksdns >/dev/null 2>&1 &
			dns2socks 127.0.0.1:1088 8.8.8.8:53 127.0.0.1:5555 -q >/dev/null 2>&1 &
		fi
	fi

	if [ -n "$UDP_RELAY_SERVER" ]; then
		if [ "$utype" == "ss" -o "$utype" == "ssr" ]; then
			case "$(uci_get_by_name $UDP_RELAY_SERVER auth_enable)" in
			1 | on | true | yes | enabled) ARG_OTA="-A" ;;
			*) ARG_OTA="" ;;
			esac
			gen_config_file $UDP_RELAY_SERVER 1 $(uci_get_by_name $UDP_RELAY_SERVER local_port 1234)
			last_config_file=$CONFIG_UDP_FILE
			pid_file="/var/run/ssr-reudp.pid"
			$ucmd -c $last_config_file $ARG_OTA -U -f /var/run/ssr-reudp.pid >/dev/null 2>&1
		elif [ "$utype" == "v2ray" ]; then
			lua /usr/share/shadowsocksr/genv2config.lua $UDP_RELAY_SERVER udp $(uci_get_by_name $UDP_RELAY_SERVER local_port) >/var/etc/v2-ssr-reudp.json
			sed -i 's/\\//g' /var/etc/v2-ssr-reudp.json
			$ucmd -config /var/etc/v2-ssr-reudp.json >/dev/null 2>&1 &
		elif [ "$stype" == "trojan" ]; then
			lua /usr/share/shadowsocksr/gentrojanconfig.lua $GLOBAL_SERVER client 10801 >/var/etc/trojan-ssr-reudp.json
			sed -i 's/\\//g' /var/etc/trojan-ssr-reudp.json
			$ucmd --config /var/etc/trojan-ssr-reudp.json >/dev/null 2>&1 &
			ipt2socks -U -b 0.0.0.0 -4 -s 127.0.0.1 -p 10801 -l $(uci_get_by_name $UDP_RELAY_SERVER local_port) >/dev/null 2>&1 &
		elif [ "$utype" == "socks5" ]; then
			/usr/share/shadowsocksr/genred2config.sh "/var/etc/redsocks-ssr-reudp.conf" socks5 udp $(uci_get_by_name $UDP_RELAY_SERVER local_port) \
			$(check_host $(uci_get_by_name $UDP_RELAY_SERVER server)) $(uci_get_by_name $UDP_RELAY_SERVER server_port) \
			$(uci_get_by_name $UDP_RELAY_SERVER auth_enable 0) $(uci_get_by_name $UDP_RELAY_SERVER username) $(uci_get_by_name $UDP_RELAY_SERVER password)
			$ucmd -c /var/etc/redsocks-ssr-reudp.conf >/dev/null 2>&1
		elif [ "$stype" == "tun" ]; then
			redir_udp=0
			echo "$(date "+%Y-%m-%d %H:%M:%S") Network Tunnel UDP TPROXY Relay not supported!" >>/tmp/ssrplus.log
		fi
	fi
	#deal with dns
	local ssr_dns="$(uci_get_by_type global pdnsd_enable 0)"
	local dnsstr="$(uci_get_by_type global tunnel_forward 8.8.4.4:53)"
	local dnsserver=$(echo "$dnsstr" | awk -F ':' '{print $1}')
	local dnsport=$(echo "$dnsstr" | awk -F ':' '{print $2}')
	if [ "$ssr_dns" != "0" ]; then # not use custom dns service
		if [ "$run_mode" == "gfw" ]; then
			ipset add gfwlist $dnsserver 2>/dev/null
		elif [ "$run_mode" == "oversea" ]; then
			ipset add oversea $dnsserver 2>/dev/null
		else
			ipset add ss_spec_wan_ac $dnsserver nomatch 2>/dev/null
		fi
	fi
	if [ "$ssr_dns" == "1" ]; then
		start_pdnsd $dnsserver $dnsport
		pdnsd_enable_flag=1
	elif [ "$ssr_dns" == "2" ]; then
		microsocks -i 127.0.0.1 -p 10802 ssr-dns >/dev/null 2>&1 &
		dns2socks 127.0.0.1:10802 $dnsserver:$dnsport 127.0.0.1:5335 -q >/dev/null 2>&1 &
		pdnsd_enable_flag=2
	fi
	if [ "$(uci_get_by_type global enable_switch)" == "1" ]; then
		if [ "$(uci_get_by_name $GLOBAL_SERVER switch_enable 1)" == "1" ]; then
			if [ -z "$switch_server" ]; then
				local switch_time=$(uci_get_by_type global switch_time)
				local switch_timeout=$(uci_get_by_type global switch_timeout)
				service_start /usr/bin/ssr-switch start $switch_time $switch_timeout
				switch_enable=1
			fi
		fi
	fi
	add_cron
	return $?
}

gen_service_file() {
	if [ $(uci_get_by_name $1 fast_open) == "1" ]; then
		fastopen="true"
	else
		fastopen="false"
	fi
	cat <<-EOF >$2
		{
		"server": "0.0.0.0",
		"server_port": $(uci_get_by_name $1 server_port),
		"password": "$(uci_get_by_name $1 password)",
		"timeout": $(uci_get_by_name $1 timeout 60),
		"method": "$(uci_get_by_name $1 encrypt_method)",
		"protocol": "$(uci_get_by_name $1 protocol)",
		"protocol_param": "$(uci_get_by_name $1 protocol_param)",
		"obfs": "$(uci_get_by_name $1 obfs)",
		"obfs_param": "$(uci_get_by_name $1 obfs_param)",
		"fast_open": $fastopen
		}
	EOF
}

start_service() {
	[ $(uci_get_by_name $1 enable 0) == "0" ] && return 1
	let server_count=server_count+1
	if [ "$server_count" == "1" ]; then
		if ! (iptables-save -t filter | grep SSR-SERVER-RULE >/dev/null); then
			iptables -N SSR-SERVER-RULE && \
			iptables -t filter -I INPUT -j SSR-SERVER-RULE
		fi
	fi
	if [ "$(uci_get_by_name $1 type ssr)" == "ssr" ]; then
		gen_service_file $1 /var/etc/${NAME}_$server_count.json
		/usr/bin/ssr-server -c /var/etc/${NAME}_$server_count.json -u -f /var/run/ssr-server$server_count.pid >/dev/null 2>&1
	else
		microsocks -i :: -p $(uci_get_by_name $1 server_port) -1 -u $(uci_get_by_name $1 username) -P $(uci_get_by_name $1 password) ssr-server$server_count >/dev/null 2>&1 &
	fi
	iptables -t filter -A SSR-SERVER-RULE -p tcp --dport $(uci_get_by_name $1 server_port) -j ACCEPT
	iptables -t filter -A SSR-SERVER-RULE -p udp --dport $(uci_get_by_name $1 server_port) -j ACCEPT
	return 0
}

gen_serv_include() {
	FWI=$(uci get firewall.shadowsocksr.path 2>/dev/null)
	[ -n "$FWI" ] || return 0
	if [ ! -f $FWI ]; then
		echo '#!/bin/sh' >$FWI
	fi
	extract_rules() {
		echo "*filter"
		iptables-save -t filter | grep SSR-SERVER-RULE | sed -e "s/^-A INPUT/-I INPUT/"
		echo 'COMMIT'
	}
	cat <<-EOF >>$FWI
		iptables-save -c | grep -v "SSR-SERVER" | iptables-restore -c
		iptables-restore -n <<-EOT
		$(extract_rules)
		EOT
	EOF
}

start_server() {
	SERVER_ENABLE=$(uci_get_by_type server_global enable_server 0)
	[ "$SERVER_ENABLE" == "0" ] && return 0
	mkdir -p /var/run /var/etc
	config_load $NAME
	config_foreach start_service server_config
	gen_serv_include
	return 0
}

start_local() {
	local local_server=$(uci_get_by_type socks5_proxy server nil)
	[ "$local_server" == "same" ] && local_server=$GLOBAL_SERVER
	[ "$local_server" == "nil" ] && return 1
	local local_type=$(uci_get_by_name $local_server type)
	mkdir -p /var/run /var/etc

	if [ "$local_type" == "ssr" ]; then
		gen_config_file $local_server 3 $(uci_get_by_type socks5_proxy local_port 1080)
		/usr/bin/ssr-local -c $CONFIG_SOCK5_FILE -u -f /var/run/ssr-local.pid >/dev/null 2>&1
	elif [ "$local_type" == "ss" ]; then
		gen_config_file $local_server 3 $(uci_get_by_type socks5_proxy local_port 1080)
		/usr/bin/ss-local -c $CONFIG_SOCK5_FILE -u -f /var/run/ssr-local.pid >/dev/null 2>&1
	elif [ "$local_type" == "v2ray" ]; then
		lua /usr/share/shadowsocksr/genv2config.lua $local_server tcp 0 $(uci_get_by_type socks5_proxy local_port 1080) >/var/etc/v2-ssr-local.json
		sed -i 's/\\//g' /var/etc/v2-ssr-local.json
		/usr/bin/v2ray/v2ray -config /var/etc/v2-ssr-local.json >/dev/null 2>&1 &
	elif [ "$local_type" == "trojan" ]; then
		lua /usr/share/shadowsocksr/gentrojanconfig.lua $local_server client $(uci_get_by_type socks5_proxy local_port 1080) >/var/etc/trojan-ssr-local.json
		sed -i 's/\\//g' /var/etc/trojan-ssr-local.json
		/usr/sbin/trojan --config /var/etc/trojan-ssr-local.json >/dev/null 2>&1 &
	else
		microsocks -i :: -p $(uci_get_by_type socks5_proxy local_port 1080) ssr-local >/dev/null 2>&1 &
	fi

	local_enable=1
}

rules() {
	if [ "$GLOBAL_SERVER" == "nil" ]; then
		return 1
	else
		redir_tcp=1
	fi
	mkdir -p /var/run /var/etc
	UDP_RELAY_SERVER=$(uci_get_by_type global udp_relay_server)
	[ "$UDP_RELAY_SERVER" == "same" ] && UDP_RELAY_SERVER=$GLOBAL_SERVER
	[ -n "$UDP_RELAY_SERVER" ] && redir_udp=1
	if start_rules; then
		return 0
	else
		return 1
	fi
}

start() {
	if [ -z "$switch_server" ]; then
		GLOBAL_SERVER=$(uci_get_by_type global global_server)
	else
		GLOBAL_SERVER=$switch_server
		switch_enable=1
	fi

	NETFLIX_SERVER=$(uci_get_by_type global netflix_server nil)
	if [ "$NETFLIX_SERVER" == "same" ]; then
		NETFLIX_SERVER=$GLOBAL_SERVER
	fi

	if rules; then
		start_redir
		mkdir -p /tmp/dnsmasq.d && cp -a /etc/dnsmasq.ssr /tmp/ && cp -a /etc/dnsmasq.oversea /tmp/
		if ! [ "$run_mode" == "oversea" ]; then
			cat <<-EOF >/tmp/dnsmasq.d/dnsmasq-ssr.conf
				conf-dir=/tmp/dnsmasq.ssr
			EOF
		else
			cat <<-EOF >/tmp/dnsmasq.d/dnsmasq-ssr.conf
				conf-dir=/tmp/dnsmasq.oversea
			EOF
		fi
		if [ $(uci_get_by_type global adblock 0) == "0" ]; then
			rm -f /tmp/dnsmasq.ssr/ad.conf
		fi
		/usr/share/shadowsocksr/gfw2ipset.sh

		if [ "$NETFLIX_SERVER" != "nil" ]; then
			if [ "$NETFLIX_SERVER" != "$GLOBAL_SERVER" ]; then
				cat /etc/config/netflix.list | while read line || [ -n "$line" ]; do
					sed -i "/$line/d" /tmp/dnsmasq.ssr/gfw_list.conf
				done
				awk '!/^$/&&!/^#/{printf("ipset=/.%s/'"netflix"'\n",$0)}' /etc/config/netflix.list >/tmp/dnsmasq.ssr/netflix_forward.conf
				awk '!/^$/&&!/^#/{printf("server=/.%s/'"127.0.0.1#5555"'\n",$0)}' /etc/config/netflix.list >>/tmp/dnsmasq.ssr/netflix_forward.conf

				ipset -N netflix hash:net 2>/dev/null
				cat /etc/config/netflixip.list | while read nip || [ -n "$nip" ]; do
					ipset add netflix $nip 2>/dev/null
				done
			else
				cat /etc/config/netflix.list | while read line || [ -n "$line" ]; do
					sed -i "/$line/d" /tmp/dnsmasq.ssr/gfw_list.conf
				done
				awk '!/^$/&&!/^#/{printf("ipset=/.%s/'"netflix"'\n",$0)}' /etc/config/netflix.list >/tmp/dnsmasq.ssr/netflix_forward.conf
				awk '!/^$/&&!/^#/{printf("server=/.%s/'"127.0.0.1#5335"'\n",$0)}' /etc/config/netflix.list >>/tmp/dnsmasq.ssr/netflix_forward.conf
				ipset -N netflix hash:net 2>/dev/null
				cat /etc/config/netflixip.list | while read nip || [ -n "$nip" ]; do
					ipset add netflix $nip 2>/dev/null
				done
			fi
		else
			rm -f /tmp/dnsmasq.ssr/netflix_forward.conf
		fi

		/etc/init.d/dnsmasq restart >/dev/null 2>&1
	fi
	start_server
	start_local
	if [ $(uci_get_by_type global monitor_enable 1) == "1" ]; then
		let total_count=server_count+redir_tcp+redir_udp+tunnel_enable+kcp_enable_flag+local_enable+pdnsd_enable_flag+switch_enable
		if [ $total_count -gt 0 ]; then
			#param:server(count) redir_tcp(0:no,1:yes) redir_udp tunnel kcp local gfw
			service_start /usr/bin/ssr-monitor $server_count $redir_tcp $redir_udp $tunnel_enable $kcp_enable_flag $local_enable $pdnsd_enable_flag $switch_enable
		fi
	fi

	ENABLE_SERVER=$(uci_get_by_type global global_server nil)
	if [ "$ENABLE_SERVER" == "nil" ]; then
		return 1
	else
		STYPE=$(uci_get_by_name $ENABLE_SERVER type nil)
		if [ "$STYPE" == "nil" ]; then
			CFGID=$(uci_get_by_cfgid servers type nil)
			if [ "$CFGID" == "nil" ]; then
				uci set shadowsocksr.@global[0].global_server='nil'
			else
				uci set shadowsocksr.@global[0].global_server=$CFGID
			fi
			uci commit shadowsocksr
			/etc/init.d/shadowsocksr restart
		fi
	fi
}

boot() {
	(/usr/share/shadowsocksr/chinaipset.sh && sleep 3 && start >/dev/null 2>&1) &
}

stop() {
	/usr/bin/ssr-rules -f
	srulecount=$(iptables -L | grep SSR-SERVER-RULE | wc -l)
	if [ $srulecount -gt 0 ]; then
		iptables -F SSR-SERVER-RULE
		iptables -t filter -D INPUT -j SSR-SERVER-RULE
		iptables -X SSR-SERVER-RULE 2>/dev/null
	fi
	if [ -z "$switch_server" ]; then
		kill -9 $(busybox ps -w | grep ssr-switch | grep -v grep | awk '{print $1}') >/dev/null 2>&1
	fi
	if [ $(uci_get_by_type global monitor_enable 0) == "1" ]; then
		kill -9 $(busybox ps -w | grep ssr-monitor | grep -v grep | awk '{print $1}') >/dev/null 2>&1
	fi
	killall -q -9 ssr-monitor
	killall -q -9 ss-redir
	killall -q -9 obfs-local
	killall -q -9 v2ray-plugin
	killall -q -9 ssr-redir
	killall -q -9 v2ray
	killall -q -9 trojan
	killall -q -9 ipt2socks
	kill -9 $(busybox ps -w | grep ssr-server | grep -v grep | awk '{print $1}') >/dev/null 2>&1
	kill -9 $(busybox ps -w | grep ssr-local | grep -v grep | awk '{print $1}') >/dev/null 2>&1
	killall -q -9 ssr-local
	killall -q -9 ss-local
	killall -q -9 kcptun-client
	killall -q -9 dns2socks
	killall -q -9 microsocks
	killall -q -9 redsocks2
	if [ -f /var/run/pdnsd.pid ]; then
		kill $(cat /var/run/pdnsd.pid) >/dev/null 2>&1
	else
		kill -9 $(busybox ps -w | grep pdnsd | grep -v grep | awk '{print $1}') >/dev/null 2>&1
	fi
	if [ -f "/tmp/dnsmasq.d/dnsmasq-ssr.conf" ]; then
		rm -f /tmp/dnsmasq.d/dnsmasq-ssr.conf /tmp/dnsmasq.ssr/* /tmp/dnsmasq.oversea/*
		/etc/init.d/dnsmasq restart >/dev/null 2>&1
	fi
	del_cron
}
